feat: 3-tier role system across all platform apps

Portal:
- Replace is_admin boolean with role column (admin/advanced/standard)
- Settings UI: 3-tier portal role select + per-app role dropdowns
- /portal-return endpoint: re-establishes session from JWT for sub-app back-links
- /api/internal/nv-users: internal endpoint for NetworkView user sync
- portal/migrate_roles.py: one-time DB migration script
- Role badges (admin/advanced/standard) in topbar and settings table

DigiServer:
- Add editor and viewer roles (portal advanced->editor, standard->viewer)
- PlaylistPermission model: grant viewer users edit access to specific playlists
- app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers
- Content routes: editor_required on create/delete, per-playlist permission check on mutations
- Admin: playlist_permissions route + template to manage viewer playlist grants
- Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal
- content_list_new: hide create/delete for viewers; Manage vs View button per permission
- manage_playlist_content: view-only mode when user lacks edit permission

NetworkView:
- backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers
- site_permissions table: one site per advanced user
- All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only)
- Portal SSO auto-upsert: user row synced from X-Auth-Role on every request
- GET /api/users: merges portal users list with local NV data (all 4 portal users visible)
- GET/PUT /api/users/:id/site-permission: assign site to advanced user
- Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator
- Sidebar: ⬡ Portal button between Settings and Logout
- Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh

IT Assets / Server Monitor:
- portal_sso.py updated: map advanced->editor/viewer, standard->readonly
- AdminUser model: add editor role + is_editor property

digiserver-v2/app/templates/content/content_list_new.html

@@ -264,7 +264,8 @@
     </h1>
     
     <div class="main-grid">
-        <!-- Create Playlist Card -->
+        <!-- Create Playlist Card — editor/admin only -->
+        {% if current_user.role in ('admin', 'editor') %}
         <div class="card">
             <div class="card-header">
                 <h2 style="display: flex; align-items: center; gap: 0.5rem;">
@@ -300,6 +301,9 @@
                 </button>
             </form>
         </div>
+        {% endif %}
+            </form>
+        </div>
         
         <!-- Upload Media Card -->
         <div class="card">
@@ -395,8 +399,9 @@
                     <div class="playlist-actions">
                         <a href="{{ url_for('content.manage_playlist_content', playlist_id=playlist.id) }}" 
                            class="btn btn-primary btn-sm">
-                            ✏️ Manage
+                            {% if playlist.id in editable_ids %}✏️ Manage{% else %}👁 View{% endif %}
                         </a>
+                        {% if current_user.role in ('admin', 'editor') %}
                         <form method="POST" 
                               action="{{ url_for('content.delete_playlist', playlist_id=playlist.id) }}"
                               style="display: inline;"
@@ -406,6 +411,7 @@
                                 Delete
                             </button>
                         </form>
+                        {% endif %}
                     </div>
                 </div>
                 {% endfor %}

digiserver-v2/app/templates/content/manage_playlist_content.html

@@ -274,19 +274,26 @@
         </div>
     </div>
     
-    <div style="margin-bottom: 20px;">
+    <div style="margin-bottom: 20px; display:flex; align-items:center; gap:1rem;">
         <a href="{{ url_for('content.content_list') }}" class="btn btn-secondary">
             ← Back to Playlists
         </a>
+        {% if not can_edit %}
+        <span style="background:#fff3cd; color:#856404; padding:6px 14px; border-radius:6px; font-size:0.85rem; border:1px solid #ffc107;">
+            👁 View-only — you don't have edit permission for this playlist
+        </span>
+        {% endif %}
     </div>
     
     <div class="content-grid">
         <div class="card">
             <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px;">
-                <h2 style="margin: 0;">📋 Playlist Content (Drag to Reorder)</h2>
+                <h2 style="margin: 0;">📋 Playlist Content{% if can_edit %} (Drag to Reorder){% endif %}</h2>
+                {% if can_edit %}
                 <button id="bulk-delete-btn" class="btn btn-danger" style="display: none;" onclick="bulkDeleteSelected()">
                     🗑️ Delete Selected (<span id="selected-count">0</span>)
                 </button>
+                {% endif %}
             </div>
             
             {% if playlist_content %}
@@ -308,11 +315,9 @@
                 </thead>
                 <tbody id="playlist-tbody">
                     {% for content in playlist_content %}
-                    <tr class="draggable-row" draggable="true" data-content-id="{{ content.id }}">
-                        <td>
-                            <input type="checkbox" class="content-checkbox" data-content-id="{{ content.id }}" onchange="updateBulkDeleteButton()">
-                        </td>
-                        <td><span class="drag-handle">⋮⋮</span></td>
+                    <tr class="{% if can_edit %}draggable-row{% endif %}" {% if can_edit %}draggable="true"{% endif %} data-content-id="{{ content.id }}">
+                        <td>{% if can_edit %}<input type="checkbox" class="content-checkbox" data-content-id="{{ content.id }}" onchange="updateBulkDeleteButton()">{% endif %}</td>
+                        <td>{% if can_edit %}<span class="drag-handle">⋮⋮</span>{% endif %}</td>
                         <td>{{ loop.index }}</td>
                         <td>
                             {% if content.content_type == 'weblink' %}
@@ -384,6 +389,7 @@
                             {% endif %}
                         </td>
                         <td>
+                            {% if can_edit %}
                             <form method="POST" 
                                   action="{{ url_for('content.remove_content_from_playlist', playlist_id=playlist.id, content_id=content.id) }}"
                                   style="display: inline;"
@@ -392,6 +398,10 @@
                                     ✕
                                 </button>
                             </form>
+                            {% else %}
+                            <span style="color:#999;">—</span>
+                            {% endif %}
+                        </td>                            </form>
                         </td>
                     </tr>
                     {% endfor %}
@@ -406,6 +416,7 @@
         </div>
         
         <div class="card">
+            {% if can_edit %}
             <h2 style="margin-bottom: 20px;">➕ Add Content</h2>
 
             <div style="margin-bottom: 24px; padding-bottom: 24px; border-bottom: 1px solid #e0e0e0;">
@@ -457,6 +468,15 @@
                 <p>All available content has been added to this playlist!</p>
             </div>
             {% endif %}
+
+            {% else %}
+            {# Viewer without edit permission on this playlist #}
+            <div style="text-align:center; padding:40px; color:#999;">
+                <div style="font-size:3rem; margin-bottom:1rem;">🔒</div>
+                <p>You have view-only access to this playlist.</p>
+                <p style="font-size:0.85rem; margin-top:0.5rem;">Contact an administrator to request edit access.</p>
+            </div>
+            {% endif %}
         </div>
     </div>
 </div>